Analyzing a Heap Dump Using Object Query Language (OQL)

OQL is a SQL-like query language to query Java heap. OQL allows to filter/select information
wanted from Java heap. While pre-defined queries such as "show all instances of class X"
are already supported by VisualVM, OQL adds more flexibility. OQL is based on JavaScript expression
language.

where class name is fully qualified Java class name (example: java.net.URL) or array class name.
char[] (or [C) is char array name, java.io.File (or [Ljava.io.File;) is name of java.io.File[] and so on.
Note that fully qualified class name does not always uniquely identify a
Java class at runtime. There may be more than one Java class with the same
name but loaded by different loaders. So, class name is permitted to be
id string of the class object.
If instanceof keyword is used, subtype objects are selected. If this
keyword is not specified, only the instances of exact class specified are selected. Both
from and where clauses are optional.

In select and (optional) where clauses, the expression
used in JavaScript expression. Java heap objects are wrapped as convenient script objects so that
fields may be accessed in natural syntax. For example, Java fields can be accessed with obj.field_name
syntax and array elements can be accessed with array[index] syntax. Each Java object selected is
bound to a JavaScript variable of the identifier name specified in from clause.

Note that 0xd404b198 is id of a Class (in a session). This is found by
looking at the id shown in that class's page.

OQL built-in objects, functions

heap object

The heap built-in object supports the following methods:

heap.forEachClass -- calls a callback function for each Java Class

heap.forEachClass(callback);

heap.forEachObject -- calls a callback function for each Java object

heap.forEachObject(callback, clazz, includeSubtypes);

clazz is the class whose instances are selected. If not specified, defaults to java.lang.Object. includeSubtypes is a boolean flag
that specifies whether to include subtype instances or not. Default value of
this flag is true.

heap.findClass -- finds Java Class of given name

heap.findClass(className);

where className is name of the class to find. The resulting Class
object has following properties:

fields - array of field objects. field object has name, signature
properties.

loader - ClassLoader object that loaded this class.

Class objects have the following methods:

isSubclassOf - tests whether given class is direct or indirect
subclass of this class or not.

isSuperclassOf - tests whether given Class is direct or indirect
superclass of this class or not.

subclasses - returns array of direct and indirect subclasses.

superclasses - returns array of direct and indirect superclasses.

heap.findObject -- finds object from given object id

heap.findObject(stringIdOfObject);

heap.classes -- returns an enumeration of all Java classes

heap.objects -- returns an enumeration of Java objects

heap.objects(clazz, [includeSubtypes], [filter])

clazz is the class whose instances are selected. If not specified, defaults to java.lang.Object. includeSubtypes is a boolean flag
that specifies whether to include subtype instances or not. Default value of
this flag is true. This method accepts an optional filter expression to filter
the result set of objects.

heap.finalizables -- returns an enumeration of Java objects that are
pending to be finalized.

heap.livepaths -- return an array of paths by which a given object
is alive. This method accepts optional second parameter that is a boolean
flag. This flag tells whether to include paths with weak reference(s) or not.
By default, paths with weak reference(s) are not included.

select heap.livepaths(s) from java.lang.String s

Each element of this array itself is another array. The later array is
contains an objects that are in the 'reference chain' of the path.

heap.roots -- returns an Enumeration of Roots of the heap.
Each Root object has the following properties:

identical function

objectid function

Returns String id of a given Java object. This id can be passed to
heap.findObject and may also be used to compare
objects for identity.

Example:

select objectid(o) from java.lang.Object o

reachables function

Returns an array of Java objects that are transitively referred from the
given Java object. Optionally accepts a second parameter that is comma
separated field names to be excluded from reachability computation.
Fields are written in class_name.field_name pattern.

Examples:

print all reachable objects from each Properties instance.

select reachables(p) from java.util.Properties p

print all reachables from each java.net.URL but omit the objects reachable
via the fields specified.

select reachables(u, 'java.net.URL.handler') from java.net.URL u

referrers function

Returns an enumeration of Java objects that hold reference to a given Java
object.

Examples:

print number of referrers for each java.lang.Object instance

select count(referrers(o)) from java.lang.Object o

print referrers for each java.io.File object

select referrers(f) from java.io.File f

print URL objects only if referred by 2 or more

select u from java.net.URL u where count(referrers(u)) > 2

referees function

Returns an array of Java objects to which the given Java
object directly refers to.

refers function

Returns whether first Java object refers to second Java object or not.

root function

If given object is a member of root set of objects, this function returns
a descriptive Root object describing why it is so.
If given object is not a root, then this function returns null.

sizeof function

Returns size of the given Java object in bytes
Example:

select sizeof(o) from int[] o

retainedsize function

Returns size of the retained set of the given Java object in bytes
Warning! Using this function for the first time on a heap dump may take
significant amount of time
Example:

select rsizeof(o) from instanceof java.lang.HashMap o

toHtml function

Returns HTML string for the given Java object. Note that this is called
automatically for objects selected by select expression. But, it may be useful
to print more complex output.
Example: print hyperlink in bold font weight

select "<b>" + toHtml(o) + "</b>" from java.lang.Object o

Selecting multiple values

Multiple values can be selected using JavaScript object literals or arrays.

array/iterator/enumeration manipulation functions

These functions accept an array/iterator/enumeration and an
expression string [or a callback function] as input. These functions iterate
the array/iterator/enumeration and apply the expression (or function) on
each element. Note that JavaScript objects are associative arrays. So,
these functions may also be used with arbitrary JavaScript objects.

filter function

filter function returns an array/enumeration that contains elements
of the input array/enumeration that satisfy the given boolean
expression. The boolean expression code can refer to the following built-in
variables.

max function

returns the maximum element of the given array/enumeration.
Optionally accepts code expression to compare elements of the array.
By default numerical comparison is used. The comparison expression can
use the following built-in variables:

lhs -> left side element for comparison

rhs -> right side element for comparison

Examples:

find the maximum length of any String instance

select max(map(heap.objects('java.lang.String', false), 'it.count'))

find string instance that has the maximum length

select max(heap.objects('java.lang.String'), 'lhs.count > rhs.count')

min function

returns the minimum element of the given array/enumeration. Optionally
accepts code expression to compare elements of the array. By default numerical
comparison is used. The comparison expression can use the following built-in
variables:

sort function

sorts given array/enumeration. Optionally accepts code expression to
compare elements of the array. By default numerical comparison is used.
The comparison expression can use the following built-in variables:

top function

returns top N elements of the given array/enumeration. Optionally accepts code expression to
compare elements of the array and the number of top elements. By default the first 10 elements
in the order of appearence is returned.
The comparison expression can use the following built-in variables:

sum function

This function returns the sum of all the elements of the given input array or
enumeration. Optionally, accepts an expression as second param. This is used
to map the input elements before summing those.

Example: return sum of sizes of the reachable objects from each Properties object

toArray function

This function returns an array that contains elements of the input
array/enumeration.

unique function

This function returns an array/enumeration containing unique elements of the
given input array/enumeration

Example: select unique char[] instances referenced from Strings. Note that
more than one String instance can share the same char[] for the content.

// number of unique char[] instances referenced from any String
select count(unique(map(heap.objects('java.lang.String'), 'it.value')))
// total number of Strings
select count(heap.objects('java.lang.String'))

More complex examples

Print histogram of each class loader and number of classes loaded by it

The above query uses the fact that, java.lang.ClassLoader has a private
field called classes of type java.util.Vector and Vector has a
private field named elementCount that is number of elements in the
vector. We select multiple values (loader, count) using JavaScript object
literal and map function. We sort the result by count (i.e., number of classes
loaded) using sort function with comparison expression.

java.lang.System has static field by name 'props' of type java.util.Properties.

java.util.Properties has field by 'table' of type java.util.Hashtable$Entry
(this field is inherited from java.util.Hashtable). This is the hashtable
buckets array.

java.util.Hashtable$Entry has 'key', 'value' and 'next' fields. Each
entry points the next entry (or null) in the same hashtable bucket.

java.lang.String class has 'value' field of type char[].

Note that this query (and many other queries) may not be stable - because
private fields of Java platform classes may be modified/removed without any
notification! (implementation detail). But, using such queries on user
classes may be safe - given that user has the control over the classes.